[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_107":108,"_109":110},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","shariff81","name","tribunal","path","main.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/shariff81/tribunal/code/main.ts","extension","id","3a6d3fbb-c4c4-4f33-8b2d-ecd54921ae91","fileId","6e2f53fa-ab1b-11f1-b4ac-1607ee4eb77e","parentId","branchId","5065b56d-f569-4c18-8af0-b7e42f8ef582","branchVersion",39,"latest",true,"createdAt",["D",1788908666991],"version",4,"fileType","http","content","/**\n * TRIGGER: HTTP\n *\n * The website. Pulls Sleeper, computes the numbers, serves the humiliation.\n *\n * Query params:\n * ?league=chuchas switch league (keys come from config.ts)\n * ?refresh=1 bust the Sleeper data cache\n * ?reroast=1 regenerate the roast (costs a model call)\n * ?format=json raw computed data, no HTML\n * ?key=... required only if SITE_PASSWORD env var is set\n */\n\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport {\n adminKey,\n canView,\n findLeague,\n isAdmin,\n LeagueConfig,\n leaguePassword,\n visibleLeagues,\n} from \"./config.ts\";\nimport {\n getDraftPicks,\n getLeague,\n getMatchups,\n getPlayers,\n getRosters,\n getState,\n getTransactions,\n getUsers,\n PlayerMap,\n} from \"./sleeper.ts\";\nimport { buildReport, LeagueReport } from \"./analytics.ts\";\nimport { getRoast, getWaiverRoast } from \"./roast.ts\";\nimport { renderPage } from \"./render.ts\";\n\nexport async function loadReport(\n leagueId: string,\n opts: { refresh?: boolean } = {},\n): Promise {\n if (opts.refresh) {\n // Nuke the volatile keys; completed weeks stay cached (they never change).\n for (const k of [`state:nfl`, `league:${leagueId}`, `users:${leagueId}`, `rosters:${leagueId}`]) {\n try { await blob.delete(k); } catch { /* wasn't there */ }\n }\n }\n\n const state = await getState();\n const league = await getLeague(leagueId);\n\n // Sleeper advances state.week on Tuesday, so the last finished week is week-1.\n const seasonMatches = state.season === league.season;\n const currentWeek = seasonMatches ? state.week : 18;\n const lastCompleteWeek = Math.max(0, Math.min(currentWeek - 1, 17));\n\n const [users, rosters] = await Promise.all([\n getUsers(leagueId),\n getRosters(leagueId),\n ]);\n\n let players: PlayerMap = {};\n try {\n players = await getPlayers();\n } catch (e) {\n console.error(\"player dump failed; falling back to raw ids\", e);\n }\n\n const weeks = Array.from({ length: lastCompleteWeek }, (_, i) => i + 1);\n const txWeeks = Array.from({ length: Math.max(1, currentWeek) }, (_, i) => i + 1);\n\n if (opts.refresh && currentWeek > 0) {\n for (const k of [`matchups:${leagueId}:${currentWeek}`, `tx:${leagueId}:${currentWeek}`, `matchups:${leagueId}:${lastCompleteWeek}`, `tx:${leagueId}:${lastCompleteWeek}`]) {\n try { await blob.delete(k); } catch { /* fine */ }\n }\n }\n\n const [matchupArrays, txArrays, draftPicks] = await Promise.all([\n Promise.all(weeks.map((w) => getMatchups(leagueId, w, w >= currentWeek).catch(() => []))),\n Promise.all(txWeeks.map((w) => getTransactions(leagueId, w, w >= currentWeek).catch(() => []))),\n league.draft_id ? getDraftPicks(league.draft_id).catch(() => []) : Promise.resolve([]),\n ]);\n\n const matchupsByWeek = new Map(weeks.map((w, i) => [w, matchupArrays[i]]));\n const txByWeek = new Map(txWeeks.map((w, i) => [w, txArrays[i]]));\n\n return buildReport({\n league,\n users,\n rosters,\n matchupsByWeek,\n txByWeek,\n players,\n currentWeek,\n lastCompleteWeek,\n draftPicks,\n });\n}\n\nconst COOKIE = \"tribunal_key\";\nconst ADMIN_COOKIE = \"tribunal_admin\";\nconst YEAR = 60 * 60 * 24 * 365;\n/** Admin sessions are short on purpose — this one spends money. */\nconst ADMIN_TTL = 60 * 60;\n\nfunction cookieValue(header: string | null, name: string): string {\n if (!header) return \"\";\n for (const part of header.split(\";\")) {\n const i = part.indexOf(\"=\");\n if (i < 0) continue;\n if (part.slice(0, i).trim() === name) {\n try { return decodeURIComponent(part.slice(i + 1).trim()); } catch { return \"\"; }\n }\n }\n return \"\";\n}\n\nconst esc = (s: unknown) =>\n String(s ?? \"\").replace(/&/g, \"&\").replace(//g, \">\").replace(/\"/g, \""\");\n\n/**\n * The login screen. Deliberately vague — it never confirms whether a league\n * exists or which ones do, so a wrong slug and a wrong key look identical.\n */\nfunction lockedResponse(requestedLeague: string, wrongKey: boolean): Response {\n return new Response(\n `\n\nLocked\n\n

🔒

${\n wrongKey\n ? \"Wrong key, or you're not in this league.\"\n : \"This league is private. Enter your key.\"\n }

\n \n

Ask the commissioner.

`,\n {\n status: 401,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n // A rejected key shouldn't leave a stale cookie behind.\n \"set-cookie\": `${COOKIE}=; Path=/; Max-Age=0; SameSite=Lax; HttpOnly; Secure`,\n },\n },\n );\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const isJson = url.searchParams.get(\"format\") === \"json\";\n\n // The commissioner's unlock form POSTs here so the admin key never lands in a\n // query string, an address bar, or Val Town's request logs. On success we set\n // a short-lived admin cookie and bounce straight into the regeneration.\n if (req.method === \"POST\") {\n const form = await req.formData().catch(() => null);\n const supplied = String(form?.get(\"admin\") ?? \"\");\n const lg = String(form?.get(\"league\") ?? \"\");\n const back = `/?league=${encodeURIComponent(lg)}`;\n if (!isAdmin(supplied)) {\n return new Response(null, { status: 302, headers: { location: `${back}&adminerr=1` } });\n }\n return new Response(null, {\n status: 302,\n headers: {\n location: `${back}&reroast=1`,\n \"set-cookie\":\n `${ADMIN_COOKIE}=${encodeURIComponent(supplied)}; Path=/; Max-Age=${ADMIN_TTL}; SameSite=Lax; HttpOnly; Secure`,\n },\n });\n }\n\n if (url.searchParams.get(\"logout\") === \"1\") {\n // Two Set-Cookie headers need Headers.append — a plain object can only\n // carry one, since header names are case-insensitive.\n const h = new Headers({ location: \"/\" });\n const expire = (n: string) =>\n h.append(\"set-cookie\", `${n}=; Path=/; Max-Age=0; SameSite=Lax; HttpOnly; Secure`);\n expire(COOKIE);\n expire(ADMIN_COOKIE);\n return new Response(null, { status: 302, headers: h });\n }\n\n // A key in the URL wins (that's how share links work); otherwise fall back to\n // the cookie from a previous visit, so nobody has to keep it in their URL bar.\n const queryKey = url.searchParams.get(\"key\");\n const key = queryKey ?? cookieValue(req.headers.get(\"cookie\"), COOKIE);\n\n // Resolve the league FIRST, then authorize it. Resolving loosely (falling\n // back to LEAGUES[0]) would hand league one to anyone typing a bad slug.\n const requested = url.searchParams.get(\"league\");\n let cfg: LeagueConfig | undefined;\n if (requested) {\n cfg = findLeague(requested);\n if (!cfg || !canView(cfg, key)) return lockedResponse(requested, !!key);\n } else {\n cfg = visibleLeagues(key)[0];\n if (!cfg) return lockedResponse(\"\", !!key);\n }\n\n // The key checked out. Remember it and bounce to a clean URL so it isn't\n // sitting in the address bar (or in a screenshot) from here on.\n if (queryKey && !isJson) {\n const clean = new URL(url);\n clean.searchParams.delete(\"key\");\n clean.searchParams.set(\"league\", cfg.key);\n return new Response(null, {\n status: 302,\n headers: {\n location: clean.pathname + clean.search,\n \"set-cookie\":\n `${COOKIE}=${encodeURIComponent(queryKey)}; Path=/; Max-Age=${YEAR}; SameSite=Lax; HttpOnly; Secure`,\n },\n });\n }\n\n // Self-links keep the key; tab links only carry one where the target needs it.\n const keyQS = key ? `&key=${encodeURIComponent(key)}` : \"\";\n const nav = visibleLeagues(key).map((l) => ({\n label: l.label,\n active: l.key === cfg!.key,\n href: `?league=${encodeURIComponent(l.key)}${leaguePassword(l) ? keyQS : \"\"}`,\n }));\n\n const refresh = url.searchParams.get(\"refresh\") === \"1\";\n\n // Regeneration spends real money, so it needs the admin key every time and is\n // never satisfied by the login cookie — otherwise anyone you ever sent a\n // master-key link to could sit on the reroast button and run up your bill.\n // Admin comes from the short-lived admin cookie, or a ?admin= param for\n // scripted use. Never from the league login cookie — that one gets shared.\n const adminParam = url.searchParams.get(\"admin\") ?? \"\";\n const adminCookie = cookieValue(req.headers.get(\"cookie\"), ADMIN_COOKIE);\n const admin = isAdmin(adminParam) || isAdmin(adminCookie);\n\n const wantsReroast = url.searchParams.get(\"reroast\") === \"1\";\n const reroast = wantsReroast && admin;\n const reroastDenied = wantsReroast && !admin\n ? (adminKey()\n ? \"That regeneration needs the commissioner key — use the box at the bottom of the page.\"\n : \"Regenerating is disabled because no ADMIN_KEY (or SITE_PASSWORD) is set on the val.\")\n : url.searchParams.get(\"adminerr\") === \"1\"\n ? \"Wrong commissioner key.\"\n : undefined;\n\n let report: LeagueReport;\n try {\n report = await loadReport(cfg.id, { refresh });\n } catch (e) {\n return new Response(\n `\n \n

Sleeper is not cooperating

${esc(String(e))}

Sleeper's API is probably having a moment. Reload in a bit.

`,\n { status: 502, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n }\n\n let roast = null;\n let waiver = null;\n let error: string | undefined = reroastDenied;\n try {\n roast = await getRoast(cfg, report, { force: reroast });\n } catch (e) {\n error = `Roast generation failed: ${String(e)}`;\n console.error(e);\n }\n try {\n waiver = await getWaiverRoast(cfg, report, { force: reroast });\n } catch (e) {\n console.error(\"waiver roast failed:\", e);\n }\n\n if (isJson) {\n return Response.json({ report, roast, waiver }, {\n // private: this is gated content, so no shared/CDN caching.\n headers: { \"cache-control\": \"private, max-age=120\" },\n });\n }\n\n const headers: Record = {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"private, max-age=180\",\n };\n if (isAdmin(adminParam)) {\n headers[\"set-cookie\"] =\n `${ADMIN_COOKIE}=${encodeURIComponent(adminParam)}; Path=/; Max-Age=${ADMIN_TTL}; SameSite=Lax; HttpOnly; Secure`;\n }\n return new Response(renderPage({ cfg, report, roast, waiver, error, keyQS, nav, admin }), { headers });\n}\n","deleted",false,"label","2027chuchasfantasyfootball",[14],"34147463-0557-4c06-a4fd-e6ce84136842",["D",1788826932920],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","2cff78f6-8d31-46e6-b18a-416622f10eba","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0586f-066e-746e-9802-983de91cc9a5","tursoName","3414746305574c06a4fde6ce84136842","tursoHostname","3414746305574c06a4fde6ce84136842-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789439460012],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_106":102},"org",{"_9":10,"_99":100,"_101":102,"_56":57,"_103":104,"_105":42},"branch",{"_35":89,"_11":90,"_22":28,"_91":46,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",46,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","amin shariff","avatar","https://lh3.googleusercontent.com/a/ACg8ocJZYFjkkYOZgkkpX4DpXOeC-Zx5JHITzpaKYMUBkZSvIFFigQ=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_140":141,"_142":143,"_144":145,"_146":42,"_147":42,"_148":42,"_149":32,"_150":-5,"_151":-7,"_152":-7,"_153":63,"_154":42,"_155":42,"_156":-5,"_157":42,"_158":42,"_159":42,"_160":-5},"ENV",{"_111":112,"_113":114,"_115":90,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]